19 - How to Configure Fine-Grained Password Policy on Windows Server 2022 (Video Tutorial in Khmer)

Hello my friend! Today I show you step-by-step how to Configure Fine-Grained Password Policy (FGPP) in Windows Server 2022! Default Domain Policy applies only ONE single password rule to entire domain. But with Fine-Grained Password Policy (PSO - Password Settings Object), you can create stricter password requirements (like 12-character password) for IT Admins or Executives, while normal staff use standard password rules! Very easy to follow with video tutorial in Khmer! Let's get started!

Step 1: Open Active Directory Administrative Center (ADAC)

Fine-Grained Password Policy is configured using Active Directory Administrative Center GUI tool:

1. Open Server Manager > click Tools > select Active Directory Administrative Center (dsac.exe).
2. On left sidebar, switch view to Tree View (or click your domain name, example: rean (local)).
3. Expand rean (local) > expand System > select Password Settings Container.

💡 Tip: Fine-Grained Password Policy (FGPP) was introduced in Windows Server 2008, but ADAC GUI tool makes creating PSOs super easy without writing complex ADSI Edit attributes!

Step 2: Create New Password Settings Object (PSO)

Now create custom password policy settings for targeted department:

1. Right-click Password Settings Container > select New > Password Settings.
2. Fill out Create Password Settings form:
   • Name: Type name (example: PSO_IT_Admins_Strict_Policy).
   • Precedence: Type 1 (Lower number = Higher priority! Example: Precedence 1 overrides Precedence 10).
   • Minimum password length: Set to 12 characters (or 14).
   • Enforce password history: Set to 5 passwords remembered.
   • Check [x] Password must meet complexity requirements.
   • Minimum password age: 1 day.
   • Maximum password age: 60 days.
   • Check [x] Enforce account lockout policy:
     • Number of failed logon attempts allowed: 5
     • Reset account lockout counter after (mins): 15
     • Account lockout duration (mins): 15

💡 Tip: Precedence determines priority if user is member of multiple PSOs! Number 1 is highest priority rule and wins against higher precedence numbers (2, 5, 10).

Step 3: Apply Password Settings Object (PSO) to Security Group

Assign this custom password policy to specific Active Directory Security Group:

1. At bottom of Create Password Settings window, look under Directly Applies To section.
2. Click Add... button.
3. In object name box, search for target Active Directory Security Group (example: GRP_IT_Admins or Domain Admins).
4. Click OK.
5. Click OK button at bottom to save new Password Settings Object!

⚠️ Warning: Always apply Fine-Grained Password Policy to Global/Universal Security Groups (like GRP_IT_Admins), NEVER apply directly to Organizational Units (OUs)! FGPP does not support OU targeting!

Step 4: Verify Resultant Password Policy for User Account

Verify which password policy is actively controlling a specific user account using PowerShell:

1. Open PowerShell as Administrator on Domain Controller.
2. Run command below replacing username with target domain user (example: sok.dara):

# Get active Fine-Grained Password Policy applied to user
Get-ADUserResultantPasswordPolicy -Identity sok.dara

3. Output will display exact PSO object details (PSO_IT_Admins_Strict_Policy) applied to that user!

💡 Tip: If Get-ADUserResultantPasswordPolicy returns blank/null output, user is using standard Default Domain Policy!

Watch Video Tutorial (Khmer)

Watch full step-by-step video tutorial below to see how to configure Fine-Grained Password Policy in Windows Server 2022 in Khmer:

Hope this tutorial help you configure Fine-Grained Password Policy easily! Practice setting up custom password policies for your domain today. Happy learning my friends! Sharing is caring!